Bludit’s image upload feature permits an authenticated user with author, editor, or administrator privileges to upload an SVG file that includes a malicious script. When a visitor requests the URL of the uploaded file, the script executes in the victim’s browser, enabling session hijacking, redirection, or other client‑side attacks. The flaw therefore provides a vector for arbitrary script execution on any user that views the uploaded resource.

The vulnerability affects the Bludit content management system. All released versions up to and including 3.18.2 are confirmed vulnerable, and later releases may also remain susceptible if the issue is not addressed. Site operators using any pre‑3.18.2 version should inspect their upload directories for SVG files that might be stored or served publicly.

The CVSS v3 score of 4.8 denotes moderate severity, and the EPSS score of less than 1% indicates that exploitation has not yet been widely reported. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated and possess upload privileges, but the resulting resource is served without authentication, exposing all site visitors to the malicious payload. Until an official patch becomes available, the risk remains moderate to high because any authenticated content uploader could introduce a malicious SVG that compromises unprivileged users.